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AMENDMENTS TO THE CLAIMS 

I. -IO. (Canceled) 

I I . (Previously presented) A method for defining a Rule-Based Markup Language 
("RBML") to describe a set of rules for managing a first network among a plurality of networks, 
the method comprising the computer-implemented steps of: 

creating one or more RBML documents for storing the set of rules, wherein the one or 
more RBML documents include one or more tags defining one or more rule 
elements, and wherein: 

a RBML document storing a symptom-event rule from the set of rules includes: 
an event tag identifying a particular event occurring on the network; and 
a symptom tag identifying a symptom as a generalized abstraction of the 
particular event; and 

a RBML document storing a problem-diagnosis rule from the set of rules 
includes: 

a problem-definition tag describing a problem; and 
a correlation tag identifying a correlation between one or more symptoms, 
wherein the one or more symptoms are defined in one or more 
symptom tags that include one or more pre-defined indicators 
associated with the one or more symptoms; and 
wherein each of the RBML documents comprises a profile block, event block, 
summary block, corrective action block, and match block, wherein the 
profile block identifies network profile elements to which a rule applies, 
wherein an event block defines which events published by a target device 
may constitute a recognized symptom, wherein the summary block 
comprises metadata defining what services or systems are entitled to use 
or execute a rule; wherein the corrective action block defines one or more 
actions that can and should be taken to correct a problem that has been 
determined to exist; wherein the match block comprises one or more 



CPOL 185311 



2 



Ser. No. 10/714,158 filed 1 1/13/2003 
Sinclair et al.- Art Unit 2453 
Docket No. 50325-081 1 

match statements that may be applied to raw data to either parse or make a 

determination about the data; 
generating, from information stored in one or more tags of the one or more RBML 
documents, one or more sequences of instructions, which instructions, when 
executed by one or more processors, cause the one or more processors to carry out 
the steps of: 

collecting and storing symptom-related data about one or more symptoms, 
wherein collecting and storing the symptom-related data includes 
monitoring the network for one or more network events identified in the 
symptom-event mle; and 

detecting a problem within the network, wherein detecting the problem includes 
applying the problem-diagnosis rule to the symptom-related data; 

receiving a request from a user to employ a particular rule in managing a second 
network, separate from the first network; and 

distributing to a device on the second network the one or more RBML documents 
storing the particular rule. 

12. (Original) A method as recited in Claim 11, wherein the step of detecting a problem 
within the network further comprises the steps of: 

comparing the symptom-related data to the one or more pre-defined indicators associated 

with the one or more symptoms to determine whether a particular symptom exists 

in the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms identified in 

the correlation tag of the RBML document storing the problem-diagnosis rule; 

and 

only if all symptoms identified in the correlation tag exist, determining that the problem 
identified in the problem-definition tag is detected. 



13. (Original) A method as recited in Claim 11, wherein the RBML document storing the 
symptom-event rule further includes: 
a profile tag identifying a particular network device; and 
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a command tag identifying a data-collection command, wherein the data-collection 
command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 

14. (Original) A method as recited in Claim 11, wherein: 

the step of creating one or more RBML documents further includes creating a RBML 
document for storing a problem-correction rule defining one or more corrective 
actions capable of correcting the problem within the network; and 

the step of generating instructions includes generating one or more sequences of 

instructions, which instmctions, when executed by the one or more processors, 
cause the one or more processors to carry out the step of recommending to a user 
the one or more corrective actions defined in the RBML document storing the 
problem-correction rule. 

15. -31. (Canceled) 

32. (Previously presented) A computer-readable storage medium carrying one or more 
sequences of instructions for defining a Rule-Based Markup Language ("RBML") to 
describe a set of rules for managing a first network among a plurality of networks, which 
instructions, when executed by one or more processors, cause the one or more processors 
to carry out the steps of: 

creating one or more RBML documents for storing the set of rules, wherein the one or 
more RBML documents include one or more tags defining one or more rule 
elements, and wherein: 

a RBML document storing a symptom-event rule from the set of rules includes: 

an event tag identifying a particular event occurring on the network; and 
a symptom tag identifying a symptom as a generalized abstraction of the 
particular event; and 
a RBML document storing a problem-diagnosis rule from the set of rules 
includes: 

a problem-definition tag describing a problem; and 
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a correlation tag identifying a correlation between one or more symptoms, 
wherein the one or more symptoms are defined in one or more 
symptom tags that include one or more pre-defined indicators 
associated with the one or more symptoms; and 
wherein each of the RBML documents comprises a profile block, event block, summary 
block, corrective action block, and match block, wherein the profile block 
identifies network profile elements to which a rule applies, wherein an event 
block defines which events published by a target device may constitute a 
recognized symptom, wherein the summary block comprises metadata defining 
what sei-vices or systems are entitled to use or execute a rule; wherein the 
corrective action block defines one or more actions that can and should be taken 
to correct a problem that has been determined to exist; wherein the match block 
comprises one or more match statements that may be applied to raw data to either 
parse or make a determination about the data; 
generating, from information stored in one or more tags of the one or more RBML 
documents, one or more sequences of instructions, which instructions, when 
executed by one or more processors, cause the one or more processors to carry out 
the steps of: 

collecting and storing symptom-related data about one or more symptoms, 
wherein collecting and storing the symptom-related data includes 
monitoring the network for one or more network events identified in the 
symptom-event rule; and 

detecting a problem within the network, wherein detecting the problem includes 
applying the problem-diagnosis rule to the symptom-related data; 

receiving a request from a user to employ a particular rule in managing a second 
network, separate from the first network; and 

distributing to a device on the second network the one or more RBML documents 
storing the particular rule. 



(Previously presented) A computer-readable storage medium as recited in Claim 32, 
wherein the instructions for detecting a problem within the network further comprise 
instructions for carrying out the steps of: 
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comparing the symptom-related data to the one or more pre-defined indicators associated 

with the one or more symptoms to determine whether a particular symptom exists 

in the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms identified in 

the correlation tag of the RBML document storing the problem-diagnosis rule; 

and 

only if all symptoms identified in the correlation tag exist, determining that the problem 
identified in the problem-definition tag is detected. 

34. (Previously presented) A computer-readable storage medium as recited in Claim 32, 
wherein the RBML document storing the symptom-event rule further includes: 

a profile tag identifying a particular network device; and 

a command tag identifying a data-collection command, wherein the data-collection 
command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 

35. (Previously presented) A computer-readable storage medium as recited in Claim 32, 
wherein: 

the instructions for creating one or more RBML documents further comprise instnjctions 
for carrying out the step of creating a RBML document for storing a problem- 
correction rule defining one or more corrective actions capable of correcting the 
problem within the network; and 

the instructions for generating one or more sequences of instructions, by using 

information stored in one or more tags of one or more RBML documents, further 
comprise instructions for carrying out the step of recommending to a user the one 
or more corrective actions defined in the RBML document storing the problem- 
correction rule. 
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